CVE-2026-104757: CWE-266 Incorrect Privilege Assignment in Javier Carazo Import and export users and customers

This vulnerability, identified as CWE-266 (Incorrect Privilege Assignment), affects the 'Import and export users and customers' product by Javier Carazo. It allows an attacker with editor-level access to escalate privileges beyond intended limits. The vulnerability is present in versions up to 2.5.5 inclusive. The CVSS 3.1 base score is 7.2, indicating high severity, with network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with editor privileges to gain higher privileges, potentially leading to full compromise of the affected system's user and customer data. This can result in unauthorized data access, modification, or deletion, severely impacting confidentiality, integrity, and availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict editor privileges to trusted users only and monitor for suspicious privilege escalations.